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DETAILED ACTION 

1 . The IDS and response of 4/24/2006 was received and considered. It is noted that the IDS 
states that the European search report for Application 2001 12 1848 was included, but is not 
found. However, the Examiner has included this search report in the art cited. 

2. Claims 1, 3-6, 9-11, 13-16 & 19-21 are pending. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1, 3-6, 9-1 1, 13-16 & 19-21 have been 
considered but are moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 112 

4. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

5. Claims 1, 3-6, 9-11, 13-16 & 19-21 are rejected under 35 U.S.C. 1 12, first paragraph, as 
failing to comply with the enablement requirement. The claim(s) contains subject matter which 
was not described in the specification in such a way as to enable one skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and/or use the invention. 

Regarding claim 1, the specification does not describe how "unchanged key information' 5 
would be restored (line 25) if "information including . . . key information of the host which has 
been changed by the virus" is extracted (i.e. the unchanged key information is not identified). 
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Regarding claim 1, the specification does not describe why key information would be 
restored if the key information is unchanged (line 25), as the preamble of the claim recites 
cleaning computer viruses. 

Regarding claim 1 , the specification does not describe from where and to where 
"unchanged key information" is restored (line 25). 

Regarding claim 1 1 , the specification does not describe how "unchanged key 
information" would be restored (lines 27-28) if "information including ... key information of the 
host which has been changed by the virus" is extracted (i.e. the unchanged key information is not 
identified). 

Regarding claim 1 1, the specification does not describe why key information would be 
restored if the key information is unchanged (lines 27-28), as the preamble of the claim recites 
cleaning computer viruses. 

Regarding claim 1 1, the specification does not describe from where and to where 
"unchanged key information" is restored (lines 27-28). 

6. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

7. Claims 1, 3-6, 9-11, 13-16 & 19-21 are rejected under 35 U.S.C. 112, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

Regarding claim 1 , it is unclear how "simulating in a computer a virtual computer 
circumstance, on which virtual computer circumstance the computer viruses will reside" is to be 
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interpreted. For the purposes of this Office Action, this is understood to mean "simulating in a 
computer a virtual computer circumstance, wherein computer viruses will reside on the virtual 
computer circumstance 

Regarding claim 1, the claim recites "activating any virus attached on the target object to 
be scanned in said simulated virtual computer circumstance to induce virus infection of the target 
object" (lines 9-11), however, the claim also recites "said target object being a host possibly 
attached by a virus" (line 8) and therefore it is unclear how infection can be induced if the host is 
already infected. This is understood to mean "activating any virus attached on the target object 
to be scanned in said simulated virtual computer circumstance to induce virus infection of the 
plurality of objects 

Regarding claim 1, it is unclear how "unchanged key information" would be restored 
(line 25) if "information including ... key information of the host which has been changed by the 
virus" is extracted (i.e. the unchanged key information is not identified). 

Regarding claim 1, it is unclear why key information would be restored if the key 
information is unchanged (line 25), as the preamble of the claim recites cleaning computer 
viruses. 

Regarding claim 1, it is unclear from where and to where "unchanged key information" is 
restored (line 25). 

Regarding claim 1 1 , it is unclear how "a computer simulation unit for simulating a virtual 
computer circumstance, on which virtual computer circumstance the computer viruses will 
reside" is to be interpreted. For the purposes of this Office Action, this is understood to mean (i a 
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computer simulation unit for simulating in a virtual computer circumstance, wherein computer 
viruses will reside on the virtual computer circumstance ". 

Regarding claim 1 1 , the claim recites "activating any virus possibly attached on the target 
object to be scanned in said simulated virtual computer environment to induce virus infection of 
the target object" (lines 10-12), however, the claim also recites "said target object being a host 
possibly attached by a virus" (line 9) and therefore it is unclear how infection can be induced if 
the host is already infected. This is understood to mean "activating any virus attached on the 
target object to be scanned in said simulated virtual computer circumstance to induce virus 
infection of the plurality of objects 

Regarding claim 1 1 , it is unclear how "unchanged key information" would be restored 
(lines 27-28) if "information including ... key information of the host which has been changed 
by the virus" is extracted (i.e. the unchanged key information is not identified). 

Regarding claim 1 1 , it is unclear why key information would be restored if the key 
information is unchanged (lines 27-28), as the preamble of the claim recites cleaning computer 
viruses. 

Regarding claim 1 1, it is unclear from where and to where "unchanged key information" 
is restored (lines 27-28). 

Claim Rejections - 35 USC § 103 
8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
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having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

9. Claims 1, 1 1 & 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over U.S. 

Patent 5,842,002 to Schnurer et al. (Schnurer) and U.S. Patent 5,485,575 to Chess et al. (Chess). 

Regarding claims 1, 1 1 & 21, Schnurer discloses simulating in a computer a virtual 

computer circumstance/trapping device (col. 5, lines 7-10 & col. 6, lines 64-67), wherein 

computer viruses will reside on the virtual computer circumstance, providing a plurality of 

objects/files to be infected by computer viruses that induce virus infection (col. 7, lines 39-43), 

loading a target object/data stream (col. 6, line 64 - col. 7, line 1 1 & col. 7, lines 25-52) to be 

scanned into said simulated virtual computer circumstance/trapping device, activating/executing 

the target object/virus to be scanned in said simulated virtual computer circumstance/trapping 

device to induce the virus infection of the target object to infect the plurality of objects to be 

infected/files and generating standard samples/infected files which have been infected (col. 7, 

lines 47-52), comparing the plurality of objects/files after processing in the activating/executing 

step with the plurality of objects/files to be infected originally provided, determining whether 

there is any change (CRC check) or not; if there is a change, the target object to be scanned 

contains virus, otherwise the target object to be scanned is free of viruses (col. 7, lines 39-52). 

Schnurer lacks analyzing to extract information on the viruses indicated by changes between the 

plurality of objects before infection and the standard samples after infection when it is 

determined that said target object to be scanned is a virus, said information including at least the 

size of the virus and key information of the host which has been changed by the virus and to 

clean the virus from the infected target object by locating the host body and the virus body in the 

target object, restoring unchanged key information of the host on the basis of said information 
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and removing the virus body from the target object after the activation step according to the virus 
size. Chess teaches generated standard samples/infected-host (col. 5, lines 17-41), where if a 
virus is attached to the threat object and the virus is activated, the target object will include a host 
body and a virus body (Fig. 3, infected host), extracting information/VAD of virus infection 
based on a comparison of the infected files (col. 2, lines 66-67 & col. 4, lines 37-45) and the 
standard samples/infected-hosts (col. 6, lines 25-32), said information including at least the 
size/length of the virus (col. 6, lines 48-54) and key information/offset which has been changed 
by the virus (col. 6, lines 45-54) and cleaning/repairing the virus based on the information/VAD 
(col. 18, lines 30-38) for the purposes of detecting and removing viruses (col. 2, lines 55-59, col. 
6, lines 17-20 & col. 22, lines 36-43). While Chess does not explicitly teach locating the virus 
body, restoring unchanged key information and removing the virus body from the target object 
according to the virus size, this is inherently done if the original target/program is to be restored 
to it's original, uninfected state (col. 22, lines 39-43 & Fig. 3). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to modify 
Schnurer to extract information on the viruses indicated by changes between the plurality of 
objects before infection and the standard samples after infection when it is determined that said 
target object to be scanned is a virus, said information including at least the size of the virus and 
key information of the host which has been changed by the virus and to clean the virus from the 
infected target object by locating the host body and the virus body in the target object, restoring 
unchanged key information of the host on the basis of said information and removing the virus 
body from the target object after the activation step according to the virus size. One of ordinary 
skill in the art would have been motivated to perform such a modification to detect and remove 
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the virus, as taught by Chess (col. 2, lines 55-67, col. 4, lines 37-45, col. 5, lines 17-41, col. 6, 
lines 17-20, col. 22, lines 36-43 & Fig. 3). 

10. Claims 3-4 & 13-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer and Chess, as applied to claims 1 & 1 1 above, in further view of Connectix Virtual PC 
software by Connectix, Described in "Connectix Virtual PC" datasheet (VPC) and "Connectix 
Virtual PC Family Frequently Asked Questions" (FAQ). 

Regarding claims 3 & 13, Schnurer, as modified above, is silent regarding details of the 
emulation. However, Connectix teaches simulating a Central Processing Unit (CPU)/Pentium 
chip (VPC, p. 1, H2), simulating an Operating System (OS)/PC-based operating system (VPC, p. 
1, 1J1 & K3), and simulating peripheral storage devices by simulating storage space and structures 
of various peripheral storage devices/CD-ROM and PC disk/floppy disk (VPC, p. 2, 1(3). Virtual 
PC is used to run applications for one platform (such as Windows) on another platform (such as 
Macintosh). Further, FAQ teaches that Virtual PC simulates both a hard disk and memory for 
the emulated software, in this case, Windows (FAQ, p. 9, T|7). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to simulate a 
CPU, OS, storage device and memory. One of ordinary skill in the art would have been 
motivated to perform such a modification to run Windows from within a Macintosh, as taught by 
Connectix (VPC, p. 1, 1(1-3, p. 2, 1J3 & FAQ, p. 9, |7). 

Regarding claims 4 & 14, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20). 
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1 1 . Claims 5-6 & 15-16 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Schnurer, Chess and Connectix, as applied to claims 4 & 14 above, in further view of U.S. 
Patent 6,067,410 to Nachenberg. 

Regarding claims 5 & 15, Schnurer discloses multiple baits of different sizes and contents 
(FAT, executables) (col. 8, lines 13-20), but lacks specifically a specific virus. However, 
Nachenberg teaches that the bulk of software viruses in DOS based systems are COM files. 
Therefore, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to include DOS COM bait files. One of ordinary skill in the art would have 
been motivated to perform such a modification to include as bait commonly infected files, as 
taught by Nachenberg (col. 8, lines 13-20). 

Regarding claims 6 & 16, Schnurer discloses simulating the system time to generate 
virtual system date and time for inducing the viruses that are sensitive to date and time (col. 7, 
lines 33-35). 

12. Claims 9-10 & 19-20, as best understood, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Schnurer, Chess and Connectix, as applied to claims 3 & 13 above, in further 
view of U.S. Patent 5,537,636 to Uchida et al. (Uchida), U.S. Patent 6,356,915 to Chtchetkine et 
al. (Chtchetkine) & U.S. Patent 6,192,456 to Lin et al. (Lin). Schnurer as modified above, 
discloses system files and bait files for inducing viruses (Schnurer col. 6, line 64 - col. 7, line 1 1 
& col. 7, lines 25-52) and teaches that VPC is software emulation of the hardware on a PC 
(Connectix FAQ, p. 9, 1(6-7), but lacks explicit disclosure of sectors, tracks, cylinders, a primary 
boot sector and corresponding blank sector of the No. 0 track, next boot sector, File Allocation 



Application/Control Number: 09/963,359 Page 10 

Art Unit: 2134 

Table, root directory sector. However, Uchida teaches that disks contain cylinders, tracks and 
sectors (col. 6, line 61 - col. 7, line 65), a primary boot sector (col. 8, lines 13-15) and 
corresponding blank sector of the number 0 track (col. 8, lines 28-32), and a File Allocation 
Table (col. 5, lines 46-50). Further, Chtchetkine teaches that the logical structure on the FAT file 
system requires a boot sector that describes the root directory sectors within the disk (col. 2, lines 
22-27). Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to assign memory to simulate a virtual hard disk including a space by 
sector number, track number and cylinder number, a primary boot sector and corresponding 
blank sector of the No. 1 track, File Allocation table and root directory sector. One of ordinary 
skill in the art would have been motivated to perform such a modification to simulate in software 
the hardware (hard disk, floppy disk) of a PC, as taught by Connectix (Connectix FAQ, p. 9, f 6- 
7), Uchida (col. 5, lines 46-50, col. 6, line 61 - col. 7, line 65, col. 8, lines 13-15 & col. 8, lines 
28-32) and Chtchetkine (col. 2, lines 22-27). As modified, Schnurer lacks a next boot sector. 
However, Lin teaches that storing multiple partitions requires multiple boot sectors (Fig. 3 & col. 
4, lines 52-54). Therefore, it would have been obvious to one having ordinary skill in the art at 
the time the invention was made to include a next boot sector. One of ordinary skill in the art 
would have been motivated to perform such a modification to use multiple partitions, as taught 
by Lin (Fig. 3 & col. 4, lines 52-54). 



Conclusion 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841 . 
The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jacques Louis- Jacques can be reached on (571) 272-6962. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 





